What is the CVSS score of EUVD-2026-37195?

EUVD-2026-37195 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Android are affected by EUVD-2026-37195?

Google Android devices in your organization are vulnerable to remote code execution through CVE-2026-0162, a critical defect in audio protocol parsing that can be triggered remotely without user…

How to fix or mitigate EUVD-2026-37195?

Within 24 hours, conduct inventory of all Pixel and AOSP-derived Android devices to establish exposure scope and identify business-critical systems. Within 7 days, implement network controls to restrict SDP traffic where operationally feasible, disable SDP parsing services on non-essential devices, enable monitoring of Android security events for suspicious audio handling, and isolate critical systems from untrusted networks. Over 30 days, maintain continuous monitoring for Google security updates and prepare a priority deployment plan; escalate to architecture and device management teams to define permanent mitigation strategies (network segmentation, device replacement for highest-risk systems, or compensating technical controls) if no patch becomes available.

Android EUVD-2026-37195

| CVE-2026-0162 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-16 Google_Devices

GHSA-56wm-h5mr-5h2r

RCE Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Google_Devices

Severity by source

Vendor (Google_Devices) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable audio SDP parser, low-complexity type confusion, no UI, full RCE impact; PR:N reflects the description's 'no privileges/no interaction,' though vendor rated PR:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Google_Devices).

CVSS VectorVendor: Google_Devices

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:36 vuln.today

CVE Published

Jun 16, 2026 - 18:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 16, 2026 - 18:51 cve.org

HIGH 8.8

DescriptionCVE.org

In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Remote code execution in Google Android's AudioSdpParser component (AudioSdpParser.cpp) allows attackers to corrupt memory through a type-confusion flaw (CWE-843) triggered while parsing SDP payloads in ParsePayloads, with no user interaction required. The bug affects Android across Pixel and AOSP-derived devices and is addressed in the June 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' with a low EPSS score of 0.23%, so risk is currently theoretical despite the total technical impact.

Technical ContextAI

The vulnerability lives in AudioSdpParser.cpp, a native C++ parser that processes SDP (session/service description) payloads for Android's audio subsystem. The root cause is CWE-843 (Access of Resource Using Incompatible Type, i.e. type confusion): the ParsePayloads routine interprets attacker-controlled payload data as one object type when it is actually another, causing the code to read or write memory using an incorrect layout. Because this occurs in unmanaged native code, the resulting out-of-bounds or mistyped access leads to memory corruption that can be shaped into control-flow hijacking. The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* identifies the affected product as Google Android generally, and the tags (Buffer Overflow, Memory Corruption, RCE) reinforce that the flaw is a native memory-safety defect in the media/audio stack rather than a logic or configuration issue.

RemediationAI

Apply the vendor fix by updating affected devices to a build with the Android security patch level 2026-06-01 or later, as published in the Pixel/Android security bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01); this is Patch available per vendor advisory, with the exact fixed version distributed as an OTA rather than a discrete version string. For fleets that cannot immediately update, compensating controls should target reachability of the audio SDP parsing path: restrict or disable the affected audio/telephony feature that ingests SDP payloads where operationally feasible, and limit exposure to untrusted networks or peers that could deliver crafted payloads to the parser - accepting the trade-off that disabling audio/VoIP-style features degrades calling or media functionality. Prioritize devices that are internet- or peer-reachable and cannot receive vendor OTAs promptly. Confirm patch coverage with vendor advisories, since Android OEM update timelines vary and non-Pixel devices may receive the fix later.